Which Countries are in the EU and EEA for data protection purposes?

The EU countries covered by GDPR and data exchange are: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden.

The EEA (European Economic Area) includes all the EU countries and Iceland, Norway and Liechtenstein.

Additionally there are countries which have an adequacy decision and so data can be passed to and from them without any additional controls too. These countries are: Andorra, Argentina, Guernsey, Isle of Man, Israel, Jersey, New Zealand, Switzerland and Uruguay.

Finally there are agreements with Japan and Canada outlined below.
Japan – only covers data transfers between private sector organisations.
Canada – only covers data that is subject to Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). Not all data is subject to PIPEDA. For more details please see the EU Commission’s FAQs on the adequacy finding on the Canadian PIPEDA.

If you have any questions about sending or storing personal information outside the UK, please contact us and we will be happy to help.